CVE-2024-40704

Aug. 15, 2024, 8:03 p.m.

Tags

psirt@us.ibm.com
CWE-522
2024-08-15
CVE-2024-40704

CVSS Score

4.9 / 10

Products Impacted

Vendor Product Versions
ibm
  • infosphere_information_server
  • 11.7, 11.7.0.1, 11.7.0.2

Description

IBM InfoSphere Information Server 11.7 could allow a privileged user to obtain sensitive information from authentication request headers. IBM X-Force ID: 298277.

Weaknesses

CWE-522
Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

CWE ID: 522

Date

Published: Aug. 15, 2024, 5:15 p.m.

Last Modified: Aug. 15, 2024, 8:03 p.m.

Status : Analyzed

CVE has been marked for Analysis. Normally once in this state the CVE will be analyzed by NVD staff within 24 hours.

More info

Source

psirt@us.ibm.com

CPEs

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a ibm infosphere_information_server 11.7 / / / / / / /
a ibm infosphere_information_server 11.7.0.1 / / / / / / /
a ibm infosphere_information_server 11.7.0.2 / / / / / / /

CVSS Data

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

Base Score
4.9
Exploitability Score
1.2
Impact Score
3.6
Base Severity
MEDIUM
CVSS Vector String

The CVSS vector string provides an in-depth view of the vulnerability metrics.

View Vector String

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/298277
psirt@us.ibm.com
https://www.ibm.com/support/pages/node/7160853
psirt@us.ibm.com